Aave has announced a recovery plan after an April 18 exploit that affected its liquidity markets and collateral positions across multiple chains.
The update outlines how DeFi United, a coalition of ecosystem participants, intends to restore rsETH’s backing and return affected markets to normal operation.
Recovery Process
The incident began when an attacker exploited a vulnerability in rsETH’s bridge from Unichain to Ethereum, causing a fraudulent transaction to be processed on Ethereum. As a result, 116,500 rsETH was released to multiple addresses, some of which were used as collateral on Aave V3 and others bridged to Arbitrum. Initial damage-control actions included the Arbitrum security council freezing 30,766 ETH linked to the exploit, but a large remaining balance still significantly impacted markets.
Currently, roughly 107,000 rsETH from the stolen amount remains locked in active positions on Aave and Compound. To address this, the protocol organized a coordinated industry response through the DeFi United initiative and published a detailed procedure to restore the token’s backing to its target peg of 1.017 ETH.
Aave explained that the plan is to convert recovered ETH into rsETH in phases and deposit it into the bridge lockbox, enabling the system to safely resume normal operations. In parallel, LayerZero and KelpDAO have implemented additional security measures to reduce the risk of similar issues recurring.
According to Aave, remediation will proceed via governance proposals on Ethereum and Arbitrum to clear affected positions. The process also includes a temporary adjustment to the rsETH price to facilitate more efficient liquidations where necessary.
Recovered tokens will be transferred to a multisig wallet controlled by DeFi United, redeemed for ETH through KelpDAO’s standard process, and then used to cover shortfalls in the impacted markets.
Recovery Projections and Risks
Aave projects these efforts could recover approximately 13,000 ETH on Aave and about 16,776 ETH on Compound. The firm emphasized that all WETH and rsETH reserves on Ethereum Core, Arbitrum, Base, Mantle, and Linea will remain frozen while the recovery is underway.
The protocol cautioned that, while the plan aims to restore rsETH without pushing losses onto users, there are execution risks. Success depends on obtaining the necessary governance approvals, the attacker not interfering with the recovery process, and the effectiveness of the newly implemented security measures once fully deployed.
The team concluded that, if executed successfully, the coordinated steps will fully restore rsETH’s backing and stabilize the affected markets.
“The successful coordinated execution of these steps as planned ensures that rsETH backing is fully restored, and all affected markets are stabilized.”